Introduction
You have all heard of the Internet, e-mail and e-commerce, in fact, all of you use it in your organizations and many of you use in your daily work. The media has long been espousing the benefits of these forms of communication and the words now seem to have transformed into action with many business solutions encompassing Internet and e-mail solutions. Having convinced us of the values the media has now turned its attention to the security issues related to this form of communication, namely digital certification. The insurance industry is yet to encompass this next stage of development. Digital certification is not a nice-to-have technology, it is a must-have. Within the next few years all members will have implemented this technology.
What are the dangers?
The main breaches in security come from hackers. Hackers are people who enjoy breaking into systems altering and amending them just for the mental stimulation and challenge. Very often they are anti-establishment or anti-big business types, who see themselves as the James Bond's of the IT world. At the recent ICMIF IT Network, members where shown how easy it is to hack into and corrupt their websites using freely available software. Once into a website it was shown how to gain access to the organizations computer networks again using freely available software. Very few firewalls were able to prevent serious hackers from bringing down computer systems. The solution offered to the IT Network was twofold, a hardware setup encompassing firewalls and cryptography for the electronic communications.
Once a hacker has gained access to your system they can go where they like, look at classified data, even download it. They could leave software that collects credit card numbers and reports them back to the hacker. Fortunately for business the hackers are not criminally minded yet, but it only a matter of time.
What security solutions are available?
One of the most effective security tools for protecting integrity and confidentiality of information transmitted on open electronic networks (Internet) is cryptography. Cryptographic technologies are nowadays widely recognized as the essential tool for security and trust in electronic communication. Two important applications of cryptography are digital signatures and encryption. Digital signatures can help to prove the origin of the data (authentication) and verify whether data has been altered (integrity). Encryption can help keep data and communication confidential.
Why do we need cryptography?
All members are increasingly using e-mail for national and international communication, we at ICMIF have seen a huge increase in members usage of e-mail. Is it secure? How do we know the person who sent the e-mail is actually who they say they are?
We all have websites and many members are starting in a small way to write business through their websites using the Internet as a distribution channel. Some are using it as a lead generation tool, others are using it to provide online quotations and one is collecting premiums via credit cards, on an unsecured line.
The main usage of the Internet by ICMIF's members in the future is likely to be as a policy servicing tool, supplying data and information to policyholders 24 hours a day 7 days a week. This form of policy servicing as well as providing creditability to the insurer is more efficient for the policyholder and insurer and will save considerable costs in policy administration and call centres. Policyholder data is confidential and requires secure lines before they will use this form of information retrieval.
Other industries particularly the banking industry are further advanced that the insurance industry in cryptography they need to be as electronic transfer of funds is essential to their business. The banks are also serious competitors to our insurance market and this technology can give them a competitive edge. Can we allow that?
What is the solution?
Half a day was spent in the ICMIF IT Network discussing the issue of securitization. The result being that the members present requested that ICMIF research the issue of Digital Certification and provide a solution that they can implement. Digital Certification is the industry term for providing digital signatures and encryption of electronic communication.
Our research showed that there was one serious supplier for digital certification solutions, Verisign in the US. Verisign currently have 90% of the server encryption market and is the only Certification Authority offering an Internet based solution. No members of the ICMIF have implemented this technology yet, but all members will ultimately have too. We have negotiated a deal for the members that is substantially better than that available to individual organizations, with the added benefit of it being personalized to the ICMIF membership and their needs. The process will involve a pilot run for 5-7 members in order to test the system before it can be opened out to the rest of ICMIF's membership and possibley to the whole of the cooperative movement. The pilot run is expected to be start early next year and run for 4 months and will involve interaction with members IT departments in both training and setup of the pilot.
The future of Digital Certification
A digital signature consists of 1,028 characters of information. The breaking of this code is virtually impossible. Compare this with the hand-written signature and the ease with which it can be copied and these days scanned and reproduced. The legal profession is currently discussing the issue of digital signatures for contractual relations.
Your insurance company could offer you a digital certificate that identifies you for other services offered through electronic means.
All computers from 2000 will incorporate swipe card facilities that will enable user identification via a digital card, much more secure that the usual password kept in the top draw in case you forget it.
These and many other business solutions will be made possible though digital certification, a must-have technology.
(For more information about the ICMIF Certification Authority project, please contact Shaun Tarbuck at: shaun@icmif.org) | 
Back to the Agenda.
